CVE-2020-5426

Scheduler for TAS prior to version 1.4.0 was permitting plaintext transmission of UAA client token by sending it over a non-TLS connection. This also depended on the configuration of the MySQL server which is used to cache a UAA client token used by the service. If intercepted the token can give an attacker admin level access in the cloud controller.

• CWE-319
• CWE-319

• https://tanzu.vmware.com/security/cve-2020-5426Third Party Advisory
• https://tanzu.vmware.com/security/cve-2020-5426Third Party Advisory

Published

Nov 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-5420Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 a…7.7
• CVE-2020-5421In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, …6.5
• CVE-2020-5422BOSH System Metrics Server releases prior to 0.1.0 exposed t…6.5
• CVE-2020-5423CAPI (Cloud Controller) versions prior to 1.101.0 are vulner…7.5
• CVE-2020-5424Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-5425Single Sign-On for Vmware Tanzu all versions prior to 1.11.3…7.9
• CVE-2020-5427In Spring Cloud Data Flow, versions 2.6.x prior to 2.6.5, ve…7.2
• CVE-2020-5428In applications using Spring Cloud Task 2.2.4.RELEASE and be…6
• CVE-2020-5429Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-5430Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-5431Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-5432Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…